Skip to main content
POST

Refresh Token

Refresh expired access tokens using a valid refresh token to maintain uninterrupted API access.

Authentication

This endpoint does not require authentication as it’s used to refresh expired tokens.

Request Body

string
required
The refresh token obtained from the login endpoint.

Response Fields

object
required
Token refresh data object containing new tokens.
string
required
Human-readable message describing the result of the operation.
string
required
Operation status. Always “success” for successful token refresh.

Error Responses

Causes:
  • Missing refresh token
  • Invalid request format
Causes:
  • Invalid refresh token
  • Expired refresh token
  • Already used refresh token
Solution: Wait for the rate limit window to reset before making another refresh request.

Usage Examples

Token Management Best Practices

Rate Limits

  • Rate Limit: 20 requests per minute per user
  • Burst Limit: 50 requests per 5-minute window

Security Considerations

  • Refresh tokens are rotated on each use for enhanced security
  • Old refresh tokens become invalid immediately after use
  • Always store the new refresh token returned from this endpoint
  • Store refresh tokens securely with appropriate encryption
  • Use secure storage mechanisms (not localStorage for sensitive apps)
  • Implement proper token cleanup on logout
  • Always use HTTPS for token refresh requests
  • Implement proper error handling without exposing sensitive information
  • Monitor for suspicious refresh patterns

Best Practices

Implement Auto-Refresh

Set up automatic token refresh before expiration to ensure uninterrupted API access.

Handle Refresh Failures

Implement proper error handling for refresh token failures and redirect to login when needed.

Update Token Storage

Always update stored tokens with the new values returned from the refresh endpoint.

Monitor Token Usage

Monitor token refresh patterns and implement alerts for suspicious activity.
Pro Tip: Implement a token manager that automatically handles token refresh in the background, so your application code doesn’t need to worry about token expiration.